Where do bug reports go?

[darkness]

	In January I discovered a problem in saslauthd which may lead
to a potential DoS attack.  I send a report and patch to
cyrus-bugs+ at andrew.cmu.edu, but received no response and the bug still
exists.  Am I sending potentially sensitive bug reports to the right
place, or has this address been abandoned?  Or should I assume my
report and patch were rejected?

Thanks,
Dale